# PhishDestroy domain threat record: ssilka-kraken-tor.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ssilka-kraken-tor.ru/
Machine-readable companion: https://phishdestroy.io/domain/ssilka-kraken-tor.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-24 23:32:57 UTC
- Last availability or vendor check: 2026-10-22 10:33:53 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Kraken

## Stored infrastructure

- Observed IP address: 104.21.86.200
- Registrar in stored WHOIS data: RU-CENTER-RU
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-20 08:53:11 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d5c2-ef58-72ed-83a1-a0bbed30df73/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ssilka-kraken-tor.ru
- Certificate Transparency search: https://crt.sh/?q=%25.ssilka-kraken-tor.ru
- Web Archive lookup: https://web.archive.org/web/*/https://ssilka-kraken-tor.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
ssilka-kraken-tor.ru is an impersonation phishing page that presents itself as Kraken. The name itself, with "ssilka" being Russian for "link," is built to catch people searching for a working Kraken address. Its Russian page title, "Официальное зеркало Kraken Onion через Tor. Безопасный вход." ("Official Kraken Onion mirror via Tor. Secure login."), shows that it targets Russian-speaking users. PhishDestroy first flagged it on 2026-09-25, and the site was still online and serving content as of 2026-10-19.

How the scam works
Fake "mirror" pages exploit the confusion around which address is the real one. A user who lands here believes they have found a trusted Tor gateway and types their Kraken login credentials into a form controlled by the operators. Those credentials, and any one-time codes entered alongside them, can be replayed against the genuine service to take over the account and empty whatever balance it holds. The promise of a "secure login" through Tor is the lure, because it makes the page feel more legitimate rather than less.

Evidence
On 2026-10-06, VirusTotal showed 5 of 91 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a low hit rate, so most security tools will still let the page load without warning. The domain appears in four AlienVault OTX pulses, which means other researchers have tied it to tracked threat activity. Among blocklists, it is currently listed by PhishDestroy.

Infrastructure
The domain was registered on 2026-04-20 through RU-CENTER-RU, about five months before PhishDestroy detected it. That gap suggests it was either kept in reserve or operated quietly while it gathered search traffic. It resolves to Cloudflare, Inc. address space geolocated to Canada, so the real origin server is hidden behind Cloudflare's proxy.

What to do
If you entered a Kraken username or password on this page, change your password immediately from the official Kraken site or app. Revoke all active sessions and API keys, and reset two-factor authentication on a device you trust. Check your account history for withdrawals or address-book changes you did not make. Change the password on any other service where you reused it. Only open Kraken through a bookmarked address and never through "mirror" links found in search results or chats. Defenders should block the domain at DNS and proxy level, add it to phishing filters, and report it to Cloudflare and RU-CENTER for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d5c2-ef58-72ed-83a1-a0bbed30df73/
VirusTotal report: https://www.virustotal.com/gui/domain/ssilka-kraken-tor.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ssilka-kraken-tor.ru
Archived copy: https://web.archive.org/web/20260924233126/https://ssilka-kraken-tor.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:48 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gM84MvD5/276920783805.png
  Captured: 2026-09-24 23:32:57 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d5c2-ef58-72ed-83a1-a0bbed30df73.png
  Captured: 2026-09-24 23:32:57 UTC
  Source report: https://urlscan.io/result/01a0d5c2-ef58-72ed-83a1-a0bbed30df73/
- URLScan capture 2: https://urlscan.io/screenshots/01a00fd8-cf6f-7710-81c1-c8bb074f165b.png
  Captured: 2026-09-24 23:31:16 UTC
  Source report: https://urlscan.io/result/01a0d5c2-ef58-72ed-83a1-a0bbed30df73/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a8c326a3-ceaa-4a2f-ac04-90d2d11bf6bf.png
  Captured: 2026-09-25 00:04:54 UTC
  Source report: https://radar.cloudflare.com/scan/a8c326a3-ceaa-4a2f-ac04-90d2d11bf6bf
  SHA-256: f452384ee078d954df3bc01c7b7f65c1c9573bfbe8e2b1452cc3b9d2eb89e3f6
- URLScan · 2026-08-17: https://screenshots.phishdestroy.io/us/01a00fd8-cf6f-7710-81c1-c8bb074f165b.png
  Captured: 2026-08-17 13:11:10 UTC
  Source report: https://urlscan.io/result/01a00fd8-cf6f-7710-81c1-c8bb074f165b/
  SHA-256: 89eaa5ea5a6c2717a5a32e7d7152a181176f91da39f5815d58926e9624a356a7
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d5c4-95f2-7339-aec3-52d6d15193d2.png
  Captured: 2026-09-24 23:33:52 UTC
  Source report: https://urlscan.io/result/01a0d5c4-95f2-7339-aec3-52d6d15193d2/
  SHA-256: 10b08919c07d569c4b7a56734a20731de450a5513cda9bef74e21143a742db43
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1469b-3c3e-72a6-abf7-4d338135fbe5.png
  Captured: 2026-10-16 21:25:48 UTC
  Source report: https://urlscan.io/result/01a1469b-3c3e-72a6-abf7-4d338135fbe5/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a146c3-988f-7059-9d37-7c8e446bb01b.png
  Captured: 2026-10-16 22:09:52 UTC
  Source report: https://urlscan.io/result/01a146c3-988f-7059-9d37-7c8e446bb01b/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a1472c-1c28-74eb-93a5-6b8861537732.png
  Captured: 2026-10-17 00:04:02 UTC
  Source report: https://urlscan.io/result/01a1472c-1c28-74eb-93a5-6b8861537732/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14748-a372-77a4-affb-9cbc5166f63d.png
  Captured: 2026-10-17 00:35:14 UTC
  Source report: https://urlscan.io/result/01a14748-a372-77a4-affb-9cbc5166f63d/
  SHA-256: d24f47ba13bdbfcf4eed947c8c976d01409cf653cb448855fa1e829231d4e5be

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:59:36Z",
        "uuid": "01a0d5c2-ef58-72ed-83a1-a0bbed30df73",
        "scanned_at": "2026-09-24T23:32:06Z",
        "final_url": "https://ssilka-kraken-tor.ru/",
        "status": 200,
        "ip": "172.67.136.155",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru"
        ],
        "ips": [
            "2a02:6b8::1:119",
            "172.67.136.155"
        ],
        "asns": [
            "13238",
            "13335"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "xn--sln18-vta.cc",
            "krakenu6upk4yrcys6nv25du7ntl7inovhnepkevynfdgkjekkklrgqd.onion"
        ],
        "doc_hash": "9b2c7587153585d4c0e4d7ee53b0a25014a1775a0bde675958671445e4bef039",
        "script_hashes": [
            "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8",
            "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "requestResize",
            "ym",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "Ya",
            "yaCounter112384039",
            "dataLayer"
        ],
        "cookies": [
            "_yasc",
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_ymBRC",
            "_ym_synced",
            "_ym112384039_lsid",
            "_ym112384039:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_jn"
        ],
        "tls": {
            "san": [
                "*.ssilka-kraken-tor.ru",
                "ssilka-kraken-tor.ru"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "ssilka-kraken-tor.ru",
            "protocol": "QUIC",
            "valid_to": "2026-11-15T15:13:53Z",
            "valid_from": "2026-08-17T15:13:54Z"
        },
        "domain_age_days": 156,
        "apex_age_days": 156,
        "tls_age_days": 38,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:06:50Z",
        "uuid": "a8c326a3-ceaa-4a2f-ac04-90d2d11bf6bf",
        "scanned_at": "2026-09-25T00:04:54Z",
        "final_url": "https://ssilka-kraken-tor.ru/",
        "status": 200,
        "history": [
            {
                "url": "https://ssilka-kraken-tor.ru/",
                "status": 200
            }
        ],
        "dom_hash": "efd67b019adbb00d6f5e21ab1ceedf6ab75294c607fde5af62caff68d8c10e00",
        "doc_hash": "9b2c7587153585d4c0e4d7ee53b0a25014a1775a0bde675958671445e4bef039",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ssilka-kraken-tor.ru",
                "type": "A",
                "value": "104.21.86.200"
            },
            {
                "name": "ssilka-kraken-tor.ru",
                "type": "A",
                "value": "172.67.136.155"
            },
            {
                "name": "ssilka-kraken-tor.ru",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:56c8"
            },
            {
                "name": "ssilka-kraken-tor.ru",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:889b"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.86.200",
        "whois": {
            "registrar": "RU-CENTER-RU",
            "created": "2026-04-20T10:53:11Z",
            "expires": "2027-04-20T10:53:11Z",
            "nameservers": [
                "igor.ns.cloudflare.com",
                "sloan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T19:35:05Z",
        "analysis_at": "2026-10-06T02:00:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2026-04-20T00:00:00Z",
        "first_seen": "2026-04-21T11:50:33Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "igor.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "igor.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sloan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.136.155"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:56c8"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:889b"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.86.200"
            }
        ],
        "dns_at": "2026-10-06T02:00:19Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.ssilka-kraken-tor.ru",
                "ssilka-kraken-tor.ru"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "52316d086a992c1c48108bc34910433798",
            "sha256": "8003b3ed44f841a2e270905a25bbd0e0c2053b2783cc2f1ac556703f64f0e83c",
            "subject": "ssilka-kraken-tor.ru",
            "valid_to": "2026-11-15T15:13:53Z",
            "valid_from": "2026-08-17T15:13:54Z"
        }
    }
}
```